diff --git a/Jenkinsfile b/Jenkinsfile
index 38427e3b999f..08218f4ecab4 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -2,8 +2,14 @@ node {
 
   stage 'checkout'
 
-  checkout([$class: 'GitSCM', branches: [[name: '*/cliqz-ci']], doGenerateSubmoduleConfigurations: false, extensions: [[$class: 'RelativeTargetDirectory', relativeTargetDir: '../workspace@script/xpi-sign']], submoduleCfg: [], userRemoteConfigs: [[credentialsId: XPI_SIGN_CREDENTIALS, url: XPI_SIGN_REPO_URL]]])
-
+  checkout([
+    $class: 'GitSCM', 
+    branches: [[name: '*/cliqz-ci']], 
+    doGenerateSubmoduleConfigurations: false, 
+    extensions: [[$class: 'RelativeTargetDirectory', relativeTargetDir: '../workspace@script/xpi-sign']], 
+    submoduleCfg: [], userRemoteConfigs: [[credentialsId: XPI_SIGN_CREDENTIALS, url: XPI_SIGN_REPO_URL]]])
+
+  
   stage 'build'
 
   def imgName = "cliqz-oss/https-everywhere:${env.BUILD_TAG}"
@@ -16,7 +22,15 @@ node {
 
     docker.image(imgName).inside("-u 0:0") {
       sh './install-dev-dependencies.sh'
-      sh '/bin/bash ./cliqz/build_sign_and_publish.sh '+CLIQZ_CHANNEL
+
+      withCredentials([
+          file(credentialsId: '173621c3-7549-4e29-8005-04175db53e37', variable: 'XPISIGN_CERT'), 
+          file(credentialsId: '3496a127-ea1c-40ab-95ee-7c830dea2a40', variable: 'XPISIGN_PASS'), 
+          [$class: 'AmazonWebServicesCredentialsBinding', accessKeyVariable: 'AWS_ACCESS_KEY_ID', credentialsId: '62c70c1d-7d0a-4eb8-9987-38288ebf25cf', secretKeyVariable: 'AWS_SECRET_ACCESS_KEY'], 
+          file(credentialsId: '368f4e39-a1c0-4e11-bafa-e14be548e3ae', variable: 'BALROG_CREDS')]) {
+
+          sh '/bin/bash ./cliqz/build_sign_and_publish.sh '+CLIQZ_CHANNEL
+      }
     }
 
     sh 'rm -rf secure'
diff --git a/cliqz/build_sign_and_publish.sh b/cliqz/build_sign_and_publish.sh
index 13f00a24226e..e2955b2b5b04 100755
--- a/cliqz/build_sign_and_publish.sh
+++ b/cliqz/build_sign_and_publish.sh
@@ -5,7 +5,7 @@ set -e
 ADDON_ID=https-everywhere@cliqz.com
 CHANNEL=$1
 PATH=/openssl-0.9.8zg/apps/:$PATH
-SECURE_PATH=./secure/$ADDON_ID
+#SECURE_PATH=./secure/$ADDON_ID
 
 if [ $# -eq 0 ];
 then
@@ -29,22 +29,22 @@ DOWNLOAD_URL=https://s3.amazonaws.com/cdncliqz/update/$CHANNEL/https-everywhere/
 echo "CLIQZ: sign"
 python ./xpi-sign/xpisign.py \
   --signer openssl \
-  --keyfile $SECURE_PATH/certs \
-  --passin file:$SECURE_PATH/pass \
+  --keyfile $XPISIGN_CERT \
+  --passin file:$XPISIGN_PASS \
   pkg/$XPI_NAME \
   pkg/$SIGNED_XPI_NAME
 
 echo "CLIQZ: upload"
-source $SECURE_PATH/upload-creds.sh
+#source $SECURE_PATH/upload-creds.sh
 aws s3 cp pkg/$SIGNED_XPI_NAME $S3_UPLOAD_URL --acl public-read
 echo "XPI uploaded to: ${S3_UPLOAD_URL}"
 
 echo "CLIQZ: publish"
 python ./cliqz/submitter.py \
-  --credentials-file $SECURE_PATH/balrog-creds.txt \
+  --credentials-file $BALROG_CREDS \
   --username balrogadmin \
   --api-root http://balrog-admin.10e99.net/api \
   --release-channel $CHANNEL \
   --addon-id $ADDON_ID \
   --addon-version $VERSION \
-  --addon-url $DOWNLOAD_URL
+  --addon-url $DOWNLOAD_URL/
diff --git a/src/chrome/content/rules/BotBot.me.xml b/src/chrome/content/rules/BotBot.me.xml
index 9d14a2cac42c..004a79847b3a 100644
--- a/src/chrome/content/rules/BotBot.me.xml
+++ b/src/chrome/content/rules/BotBot.me.xml
@@ -4,7 +4,7 @@
 		- botbot.me
 
 -->
-<ruleset name="BotBot.me">
+<ruleset name="BotBot.me" default_off='expired certificate'>
 	<target host="botbot.me" />
 	<target host="www.botbot.me" />